CodeAstro Online Classroom CVE-2026-7741

An authenticated user account (student) is required to access the /OnlineClassroom/studentlogin endpoint, as indicated by CVSS PR:L. The sid parameter must be passed through the login function without input validation or parameterization. Exploitation does not require user interaction (UI:N) beyond submission of a crafted login request. The vulnerability is limited to confidentiality, integrity, and availability of data within the CodeAstro Online Classroom application scope (S:U) and does not extend to other systems unless lateral movement occurs via database access.

CVSS 6.3 with CVSS:3.1/AV:N/AC:L/PR:L indicates moderate severity but with important context from other signals. The CVSS Attack Vector (AV:N) and Attack Complexity (AC:L) confirm low barrier to exploitation; however, PR:L (Privilege Required: Low) means an attacker must first authenticate, reducing exposure to casual attackers. The E:P (Exploit Code Maturity: Proof-of-Concept) in the vector is corroborated by publicly available exploit code on GitHub, significantly elevating real-world risk. The CVSS scope (S:U) limits impact to the vulnerable component itself rather than other services. No EPSS score is provided, but the combination of low complexity, public POC availability, and authentication requirement suggests this is a targeted rather than widespread threat - an attacker would need valid student credentials to exploit. The moderate CVSS score accurately reflects the balance between technical exploitability and the authentication hurdle. This is a legitimate priority for CodeAstro deployments, particularly if student accounts are easily obtained or shared.

An attacker with a stolen or guessed student account logs into CodeAstro Online Classroom and accesses the /OnlineClassroom/studentlogin endpoint. They inject a SQL payload into the sid parameter (e.g., sid=1' OR '1'='1) to bypass authentication or extract sensitive data from the student database, such as other users' credentials, personal information, or grades. If database permissions are misconfigured, the attacker could potentially escalate to modifying records or executing commands.